NeuralStackCybersecurity disclosures this week show attackers actively targeting internet-facing infrastructure while researchers demonstrate how AI can accelerate the development of sophisticated browser exploits. Cisco warned that attackers are exploiting a critical Secure Email Gateway flaw that allows an unauthenticated sender to write files to the appliance’s operating system and potentially execute commands as root. The vulnerability is tracked as CVE-2026-76519 and carries a CVSS score of 9.8.
The Cisco issue affects gateways with the File Reputation service enabled and a Content Scanner Tools package older than version 25.3.0.5525. Cisco said fixes have been available through AsyncOS 15.5.5-014 and 16.5.0-780, while the Content Scanner Tools update can be installed without a software upgrade or restart. The attack begins with an email containing a crafted attachment sent through the gateway.
Attackers also exploited a flaw in Collabora Online - Built-in CODE Server, an optional Nextcloud app, to plant web shells on Nextcloud servers. The vulnerability permits an unauthenticated request to run a command when the app’s local document server is not running, including during a restart, upgrade or after a crash. Collabora fixed the issue in version 26.4.303 and warned that disabling the app is not enough; administrators must update or remove it.
Ivanti Connect Secure users face a separate actively exploited authentication-bypass flaw, CVE-2026-104935, which can let a remote unauthenticated attacker execute arbitrary commands. CISA urged organizations to update immediately and added the vulnerability to its Known Exploited Vulnerabilities catalog, with federal civilian agencies required to apply fixes by October 16, 2026. Honeypots recorded 105 exploit attempts, according to the source article.
The risks extend beyond appliances and server software. The curl project patched a use-after-free flaw in HTTP/2 upload handling, CVE-2026-92392, after a researcher demonstrated client-side code execution. The attack requires a client to upload a file of roughly 135KB to an attacker-controlled server over HTTP/2, and the flaw affects curl and libcurl versions 8.12.0 through 8.22.0.
Researchers at XBOW meanwhile chained three previously unknown Google Chrome bugs into an exploit that runs code on a Windows computer when a user loads a web page. They built the chain in six days by directing AI agents running OpenAI’s publicly available GPT-5.6 Sol model, and Google confirmed and fixed all three bugs after paying XBOW its top reward of $250,000.
Why this matters
The incidents illustrate two converging pressures for security teams: active exploitation of flaws in perimeter systems and faster development of complex attack chains. A malicious email, a vulnerable optional app, or an unauthenticated appliance interface can provide a path to high-impact control, while AI-assisted research suggests that advanced browser exploit development may become less time-consuming.
Organizations should prioritize the specific Cisco, Collabora, Ivanti and curl fixes relevant to their deployments, verify that optional components are updated or removed, and treat exposed security appliances as urgent patching targets. The Chrome research also points to a future in which defenders will need to assess not only individual bugs but how quickly automated systems can combine them into practical attacks.